# AUDIT PACKAGE — NoName Fleet
# Generated: 2026-07-04T18:18Z
# Classification: NEED_TO_KNOW — LOCAL ONLY

## Package Structure

```
AUDIT_PACKAGE_2026-07-04/
├── 01_DOCUMENTATION/           ← All standardization docs
│   ├── PORT_STANDARDIZATION.md
│   ├── ENGINE_STANDARDIZATION.md
│   ├── TOOLING_STANDARDIZATION.md
│   ├── DATABASE_STANDARDIZATION.md
│   ├── WIREGUARD_MAP.md
│   ├── PERMISSIONS_STANDARDIZATION.md
│   ├── IDENTIFICATION_MAP.md
│   ├── SCHEMA_MAP.md
│   ├── TOOLING_MAP.md
│   ├── Need_To_Know.md
│   └── rules.md
│
├── 02_ORIGIN_WEB/              ← Complete Origin web application
│   ├── dashboard/              ← Admin dashboard (PHP)
│   │   ├── core/               ← Config, routing, RBAC, tabs, auth
│   │   ├── api/                ← REST API endpoints (audit, mesh, fleet, etc.)
│   │   ├── tabs/               ← 25+ dashboard tab pages
│   │   ├── security/           ← DecryptionService, AuditRateLimiter, etc.
│   │   └── assets/             ← CSS, JS, images
│   ├── public/                 ← Public storefront (HTML/CSS/JS/PHP)
│   │   ├── assets/             ← Stylesheets, scripts, fonts
│   │   ├── pages/              ← Checkout, account, product pages
│   │   └── index.php           ← Entry point
│   ├── shared/                 ← Shared libraries (db.php, encryption, etc.)
│   └── private/                ← Private config (credentials, HMAC keys)
│
├── 03_TOOLING/                 ← Per-node bash tooling (plaintext source)
│   ├── Shield_414342/
│   │   ├── raw/                ← 50 bash tools (canonical source)
│   │   ├── engine.json         ← TOOL_ID → disguised name mapping
│   │   └── systemd/            ← 3 systemd unit files
│   ├── Origin_558201/
│   │   ├── raw/                ← 67 bash tools
│   │   ├── engine.json
│   │   └── systemd/
│   ├── Proxy_244939/           ← 49 tools
│   ├── Filter_333941/          ← 49 tools
│   ├── DNS_199335/             ← 49 tools
│   ├── Engine_669427/          ← 53 tools (includes SCLS audit_logger.sh, gen_audit_keys.sh)
│   ├── Payment_714820/         ← 49 tools
│   └── Vault_869377/           ← 50 tools
│
├── 04_ENGINE_BUILD/            ← C++ Engine daemon source + deploy scripts
│   ├── src/                    ← C++ source (engine_main.cpp, etc.)
│   ├── deploy/                 ← firewall_engine.sh, engine_bringup.sh, 669427.env
│   ├── database/               ← SQL migrations (01-06)
│   └── CMakeLists.txt
│
├── 05_DATABASE/                ← Database schemas and dumps
│   ├── 01-engine.sql through 06-scls.sql
│   ├── origin_store_full_dump.sql
│   └── origin_store_dump.sql
│
├── 06_CERTS/                   ← SSL certificates (public only)
│   ├── origin_cert.pem
│   └── origin_dash.pem
│
├── 07_REMOTE_CONFIGS/          ← PULLED FROM NODES (see pull_remote_configs.sh)
│   ├── Shield_414342/
│   │   ├── nginx/              ← N/A (no nginx)
│   │   └── wireguard/          ← wg7.conf, compass.conf, rain.conf, umbrella.conf, etc.
│   ├── Origin_558201/
│   │   ├── nginx/              ← nginx.conf, sites-enabled/*, conf.d/*
│   │   └── wireguard/          ← wg7.conf, compass.conf, lantern.conf, etc.
│   ├── Proxy_244939/
│   │   ├── nginx/              ← nginx.conf, sites-enabled/* (reverse proxy)
│   │   └── wireguard/          ← wg7.conf, compass.conf, shale.conf
│   └── ... (all 8 nodes)
│
├── MANIFEST.md                 ← This file
├── pull_remote_configs.sh      ← Script to SSH-pull nginx/WG configs from nodes
└── AUDIT_NOTES.md              ← Key audit points and cross-reference guide
```

## What's Included (LOCAL)

| Category | Files | Source |
|----------|------:|--------|
| Documentation | ~15 | Y:\documents\ |
| Origin Web (dashboard + public + shared) | ~300+ | Y:\live\ |
| Bash Tools (8 nodes × ~50 tools) | ~416 | Y:\{node}\tooling\raw\ |
| engine.json maps | 8 | Y:\{node}\tooling\ |
| systemd units | ~10 | Y:\{node}\tooling\systemd\ |
| Engine C++ source + deploy | ~30 | Y:\669427\build-v2\ |
| Database schemas | ~8 | Y:\669427\build-v2\database\ |
| SSL certs (public) | 2 | Y:\live\ |

## What Needs SSH Pull (REMOTE)

| Category | Nodes | Command |
|----------|-------|---------|
| WireGuard configs | All 8 | `bash pull_remote_configs.sh` |
| nginx configs | Origin, Proxy | `bash pull_remote_configs.sh` |
| firewalld zone export | All 8 (except DNS=UFW) | `bash pull_remote_configs.sh` |
| MariaDB status | Engine, Origin, Payment | `bash pull_remote_configs.sh` |

## Security Notes

- **NO private keys** are included in this package
- **NO HMAC secrets** or vault keys
- **NO passwords** — credential files in `private/` contain encrypted values only
- SSH keys (gabriella, PPK) are NOT included
- Encrypted tool files (.enc) are NOT included — only plaintext source (raw/)

## Cross-Reference Guide

For the auditor:

1. **Firewall rules** → `PORT_STANDARDIZATION.md` maps every port to every node
2. **Tool identity** → `TOOLING_MAP.md` has TOOL_ID → disguised name per node
3. **HMAC protocol** → `ENGINE_STANDARDIZATION.md` §HMAC Protocol
4. **Database schema** → `DATABASE_STANDARDIZATION.md` + `SCHEMA_MAP.md`
5. **Tunnel topology** → `WIREGUARD_MAP.md` v3.2
6. **Security rules** → `rules.md` (master policy doc)
